Dropbox Suffers From Old Hack As Users Email Addresses Become Compromised

Dropbox Suffers From Old Hack As Users Email Addresses Become CompromisedDropbox announced yesterday they’ve surpassed one billion uploads a day as well as a number of new features they’re currently cooking up, but as you’ve probably learned by now, what goes up, must come down.

According to a number of Dropbox users who voiced their frustrations on the services official forums as well as across a number of social media services, it seems Dropbox is still suffering from its system hack that occurred this past July as users are reporting their emails may have been compromised yet again this week.

Email addresses that were created specifically to be used with Dropbox have been receiving spam messages as far as February 20th. One forum user writes, “I have an internal to my company email address that I used for Dropbox only and I am getting the same fake paypal scam emails. This has been happening since about Monday.” (more…)

By Ubergizmo. Related articles: CloudFlare Is Down, Taking Thousands Of Websites With It, YouTube Gets In On The Harlem Shake Craze,

China accuses US of systematic hacking

The Chinese government has accused the US of a torrent of hacking attempts, blaming hackers in the United States for nearly two-thirds of all cyber-terrorism made against the country. The Chinese Department of Defense and the Chinese military have together faced 144,000 hack attempts per month on average, the country’s Ministry of Defense said today, with spokesperson Geng Yansheng citing US IP addresses as the telltale giveaway for who was responsible.

gw19b-china-flag-great-wall1

Responding to a question about the supposed 61,000-plus strong cyber-terrorism squad China had reportedly gathered together to conduct internet espionage against the US, Canada, UK, France, and other countries, as well as extract trade secrets, Geng argued that China itself was just as much a victim. He claimed that over 1.7m attempts to crack Chinese government sites were observed in 2012 alone, and that attacks from the US accounted for 62.9-percent of the incidents.

Ironically, given the Chinese ministry’s apparent reliance today on IP addresses to blame US-based hackers, it’s only little more than a week since it dismissed suggestions that such identifiers were foolproof evidence. Back on February 20, a Chinese spokesperson blamed spoofed IP addresses for the country being falsely accused of making its own hack attempts.

According to Geng, the US’ pre-emptive plans for cyber-warfare – part of the response to various incidents around newspapers, American companies, and other organizations – “are not conducive to the joint efforts of the international community to enhance network security.” The Chinese government supposedly hopes that the US be “made to explain and clarify” its aggressive stance, the spokesman continued.

China has been named as the number one risk for cyber-attacks worldwide by various reports and investigations, with suggestions that both the Chinese military and local companies have been targeting foreign networks in an attempt to extract industrial secrets, among other things. In January 2012, the US government bolstered its Cyber Command division with new teams to go on the offensive when needed in the face of online warfare, as well as to defend essential and corporate systems within the country.

[via ZDNet]


China accuses US of systematic hacking is written by Chris Davies & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Twitter, Tumblr, Pinterest User Email Addresses Stolen Due To Zendesk Hack

Twitter, Tumblr, Pinterest User Email Addresses Stolen Due To Zendesk Hack

It seems no Twitter account has been safe these days as Burger King, Jeep and even Anonymous have had their accounts hacked. Things are going to get way worse as it looks as though Zendesk suffered from a security vulnerability earlier today.

Most people may not have ever heard of Zendesk, but you should know a number of their clients they provide customer support services for, such as Tumblr, Pinterest and Twitter. The security vulnerability has been patched, according to a Zendesk blog post, but unfortunately, your email address is probably in the hands of these hackers if you’ve ever sent an email to Tumblr, Pinterest and Twitter’s customer support.

There is some good news in all this as Zendesk is reporting only email addresses have been stolen, so your passwords are safe and sound for the time being. Unfortunately, having your email address stolen can still pose a number of risks for phishing scams to make their way into your inbox. If you’re not one to fall for these kinds of emails, then you shouldn’t have much to worry about. But if you have relatives who tend to believe a Nigerian prince wants to give them money, you may want to send them a quick text giving them a heads up on this security breach.

By Ubergizmo. Related articles: Pope Benedict XVI Stepping Down From Twitter On Feb. 28, Facebook Reportedly Launching Cold Storage Servers For Your Old Photos,

Anonymous Hacked

Anonymous HackedI guess there is no need for any long winded title, especially when you consider how hacker collective Anonymous have had done their bit in the past to deface several websites before. In a nutshell, what goes around, comes around, and BBC News has reported that this week saw Anonymous suffer from “an embarrassing breach, as one of its popular Twitter feeds is taken over by rival hacktivists.”

The Anonymous Twitter hack came after a couple of other high-profile Twitter hacks that happened, including Burger King that tweeted a false dawn of rival McDonald’s purchasing it to deliver what we can presume to be McWhoppers, while Jeep’s Twitter feed too, was hacked, having seen its logo change, too. This is definitely highly preventable in the first place, and chances are the hack is a result of poor password practices.

Having said that, just how secure are your Twitter, email and online banking accounts? Do you use the same password across multiple accounts, or do you have that kind of eidetic memory that ensures you can throw in 16-character passwords that comprise of a mixture of uppercase, lowercase, numbers and symbols which are different throughout all 10 accounts without batting an eyelid?

By Ubergizmo. Related articles: Chromebook Pixel Konami Code Easter Egg, Chrome Delivers Voice Recognition Capability To The Internet,

Twitter, Tumblr, and Pinterest affected by Zendesk security breach

Three major Zendesk clients were affected by the security breach this week that allowed hackers into their systems. Zendesk is a customer service software provider and it announced this week that its system had been compromised. The three major clients affected by the security breach include twitter, Pinterest, and Tumblr.

zendesk

Zendesk announced the security breach via a blog post early Thursday night. Tumblr notified affected users via e-mail at 6:35 PM PST on Thursday night that their accounts may have been affected by the security breach. Both twitter and Pinterest are expected to begin notifying affected users soon.

Zendesk wrote that it had become aware that a hacker had access to its system this week and as soon as it learned about the attack it patched the vulnerability and closed the hackers access. The company says that the hacker had access to support information that three of its major customer store on it system. The hacker is believed to have downloaded e-mail addresses of users that had contacted those three companies for support.

The hacker was also able to obtain support e-mail subject lines. Wired reports that it has a source claiming that some customers could have had their phone number revealed as well, but no passwords, password hashes, or encrypted passwords were stolen by the hacker. None of the three companies affected in the hack are aware of any user accounts being compromised.

[via Wired]


Twitter, Tumblr, and Pinterest affected by Zendesk security breach is written by Shane McGlaun & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Update Java warns Apple after Mac hack

Apple has pushed out a new Java update to address the malware loophole that saw hackers attempt to extract data from the company, stripping out the Apple-provided browser plugin in the process. The update, which follows Apple’s confirmation that a “small number” of its systems had been compromised by an unknown hacking group, basically removes the Java applet plugin from all browsers on an OS X 10.7+ machine.

imac-2012-22-SlashGear-580x412

If the user subsequently wants to access Java applets, they’ll see a “Missing plug-in” warning in the page; clicking that will go to Oracle, to download the newest official version. In the process, the update also removes the Java Preferences application, which Apple says is no longer required.

The malware response follows the identification of several loopholes in Java, one of which allows the hackers to compromise some of Apple’s own systems. “Multiple vulnerabilities existed in Java 1.6.0_37,” the company writes in its security alert, “the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox.”

A Java flaw is believed to have been at the root of Facebook’s hack incident earlier this month, with the social network’s own systems targeted. Oracle itself documented the problem back at the start of February, reacting to security warnings which saw several firms recommend all Java implementations be shut down as a precaution.

Apple maintains that “there was no evidence that any data left” the company, and has pushed out the new update as both a standalone patch and via the Software Update tool in OS X.


Update Java warns Apple after Mac hack is written by Chris Davies & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Jeep Twitter Account Hacked, Gets Logo Change

Jeep Twitter Account Hacked, Gets Logo ChangeIt was just yesterday when we reported on Burger King’s official Twitter account being hacked early in the morning, and the pranksters there decided to tweet the entire world that the fast food chain was being bought over by McDonald’s. Well, a somewhat similar situation has occurred today, and the transportation industry is involved this time around, as Jeep’s Twitter account was hacked, with its logo being taken down and replaced by the Cadillac emblem.

Briefly earlier this morning, followers of Jeep’s Twitter account would most probably have been shocked to see the Cadillac emblem appear, no thanks to a group of mischievous hackers. Apart from the logo change, there was also a tweet that mentioned that Jeep had been sold to General Motors. It was sometime around 3pm when Chrysler regained control of their own Twitter feed, and said, “Thanks for all the heads up on one of our brand accounts. The team is on it. It’s good so many of you have our back!” Looks like the worst is over, huh?

By Ubergizmo. Related articles: Backblaze Offers 180TB Storage Pod, Apple Newest Target Of Hackers,

China denies hacking against the US

Earlier this morning we reported that allegations have surfaced that China was conducting cyber attacks against the United States. The alleged attacks were being conducted on American media companies and other businesses. Media companies including the New York Times, Washington Post, and the Wall Street Journal have all said that they were the target of cyber attacks that originated within China.

gw19b-china-flag-great-wall

Allegations have claimed that the Chinese government is supporting hacker groups within the country. The hacks are believed to have originated from a unit of the People’s Liberation Army called Unit 61398. China has dismissed the accusations of hacking against the US and other countries as “groundless.”

Chinese Foreign Ministry spokesman Hong Lei has stated that he doubted evidence collected would withstand scrutiny. Hong also said that making groundless accusations based on rough material is “neither responsible nor professional.” Hong made these comments during a regularly scheduled news conference. China continues to maintain that it has also been the target of coordinated cyber attacks along with the United States and other countries.

Hong said that cyber attacks and cyber crimes within China “are rising rapidly every year.” China has also reiterated that it has laws that strictly outlaw hacking. The most recent allegations, which some call the most damaging ever against China, come from a security company based in Virginia called Mandiant Corp.

[via AP]


China denies hacking against the US is written by Shane McGlaun & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

FROST attack compromises Android smartphones using cold

If you use an Android smartphone, you may feel secure in the fact that your PIN number or unlock pattern will protect the data on your device if you should lose it. As it turns out, neither of those security protections may be able to protect your device from a new attack that exploits the phone after it’s been placed in a freezer and thoroughly chilled. The attack is called the “FROST” attack and has been demonstrated by a pair of researchers from Erlangen University in Germany.

frost-attack

The researchers were able to demonstrate that a “cold boot attack” can read data from a Samsung Galaxy Nexus smartphones running the latest version of the Android operating system. The researchers were successful in accessing data on the smartphone even though the phone was protected by a PIN number and had contents of its storage disk encrypted. The researchers are calling their attack FROST or Forensic Recovery of Scrambled Telephones.

The process involves placing the phone in a freezer and chilling it to around 5°F and then quickly rebooting it. The researchers say that they discovered using this technique they were able to read data from the phone memory including images, e-mails, and the web browsing history. The researchers report that in some cases there were able to retrieve the key allowing them to decrypt the phones encrypted storage drive.

This attack technique was demonstrated on computers back in 2008, but this is the first time it has been used to exploit mobile devices. Forbes reports that the attack takes advantage of something called “remanence,” a term describing information that lingers in the memory of the device for a few moments after the power source has been removed. FROST takes advantage of the fact that the colder the memory, the longer the information is able to linger. The researchers removed the phone battery and replaced it while holding the power and volume buttons causing the phone to enter fastboot mode. Data can then be offloaded from the phones RAM via USB. The only defense from this attack is apparently to turn the phone off before it leaves the owner’s possession.

[via Forbes]


FROST attack compromises Android smartphones using cold is written by Shane McGlaun & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

iOS lock screen can be bypassed with some button mashing… again (video)

iPhone 5 review

It seems that every time Apple introduces a new version of iOS, it creates some new method to get past the software’s lock screen. A YouTube tutorial reveals the rather simple combination of button presses and fake emergency calls necessary to give you access to anyone’s iDevice — or more specifically to the iOS phone module, from where you can make calls or view and edit contacts. You’ll have to be quick-fingered, however, as you have to push the home button rapidly after getting into the iPhone’s contact list. You can learn how to do it after the break, but until Cupertino issues an update, we’d suggest keeping your beloved fondlephone close by.

Filed under:

Comments

Via: Gizmodo, S1riOS6 (Spanish)